User Switching

User Switching lets an authorized administrator temporarily view the site as another non-privileged user without knowing that user’s password.

Use it to verify role capabilities, User Access Manager admin-access rules, admin toolbar visibility, Admin Menu Visibility rules, and other user-specific behavior.

Setup Guide

  1. Go to Admin Optimizer > Admin & Users.
  2. Enable User Switching.
  3. Save the settings.
  4. Go to Users > All Users and choose an eligible non-administrator account.

After the module is enabled, eligible target users show a Switch to user action on the Users screen. Eligible user profile screens also show Switch to this user.

Switching sessions expire automatically after 60 minutes. Developers can change the duration in seconds with the adminoptim_user_switching_session_duration filter.

add_filter( 'adminoptim_user_switching_session_duration', function () {
	return 30 * MINUTE_IN_SECONDS;
} );Code language: PHP (php)

Permissions

By default, initiating a switch requires edit_users. Administrator accounts, accounts with the effective manage_options capability, multisite super administrators, the current user, and nested switches are blocked.

Developers can customize initiation and target eligibility with:

  • adminoptim_user_switching_can_switch
  • adminoptim_user_switching_target_allowed

These filters are restrictive-only: callbacks can deny an otherwise valid switch, but cannot bypass the edit_users requirement or the built-in self, nested-session, Administrator, manage_options, and multisite Super Admin restrictions.

Switching Back

When a switching session is active, Admin Optimizer adds a Switch back action to the admin toolbar when the toolbar is visible.

On wp-admin screens, a persistent notice also shows the active switched user and a nonce-protected switch-back link.

Switch back before the session expires. Switching back invalidates the session immediately, so the same switch-back link cannot be reused.

Security

Switching sessions are short lived. The browser receives only an opaque session/token cookie. The server stores the session in a transient with a hashed token, original user ID, target user ID, timestamps, and a validated same-site return URL.

The original administrator is restored only from the validated server-side session. Original user IDs are not trusted from URL parameters.

User Access Manager Compatibility

After switching, the target account receives its real WordPress roles and capabilities. User Access Manager restrictions continue to apply normally.

The switch-back endpoint remains available even when User Access Manager blocks the switched role from wp-admin.

Verify It’s Working

  1. Open Users > All Users as an administrator.
  2. Click Switch to user for an Editor, Author, Subscriber, or custom non-privileged role.
  3. Confirm WordPress opens the dashboard, or the site home page when that role is blocked from wp-admin.
  4. Check that the user sees only the capabilities, toolbar, and admin menus assigned to them.
  5. Use Switch back in the admin toolbar or wp-admin notice.
  6. Confirm your administrator session is restored.

Common Mistakes

  • Trying to switch into the current user, an Administrator, an account with manage_options, or a multisite super administrator. These targets are always blocked.
  • Trying to start another switch while already switched. Nested switching is not supported.
  • Expecting User Switching to bypass User Access Manager. The target user’s real restrictions still apply.
  • Disabling both the admin toolbar and access to wp-admin without first confirming how you will return. The protected switch-back endpoint remains available, but no floating frontend switch-back control is added.

Notes

User Switching is a standalone Pro module. It does not change passwords, copy roles, or permanently modify the target account.